Read the sections below in order or jump to one directly.
MyITER ("MyITER", "we", "us", or "our") is an independent, student-developed productivity and community platform for students of ITER, SOA University, Bhubaneswar. The Service is operated by the individual developer(s) and student contributors who maintain the myiter.in domain and its subdomains (collectively, the "MyITER Team"). MyITER is not a registered corporate entity, and it does not act as an agent, processor, or representative of ITER, SOA University, or any other educational institution.
This Privacy Policy describes the categories of personal data we collect, the purposes and legal bases for processing it, how it is stored, shared, retained, and protected, and the rights and remedies available to you. It applies to the MyITER website, the installable progressive web application, the associated application programming interfaces, push notification services, and every feature through which this Policy is made available to you.
Individual features, including EduTrack, the Social Feed, Anonymous Chat, Polls and Forms, the Hostel Menu, Notices, Curriculum, The Archive, Section Manager, Notifications, Settings, and the Student Dashboard, are additionally governed by the service-specific privacy notices published under this section. Those notices supplement this Policy. In the event of a conflict, the service-specific notice prevails for that feature only, and this Policy continues to apply in all other respects.
By creating an account, entering Guest Mode, or otherwise accessing or using the Service, you acknowledge that you have read and understood this Policy and that you consent to the practices described in it. If you do not agree, you must discontinue use of the Service and request deletion of any data already collected.
We collect the information that you submit when you register, configure, or use the Service. This includes your email address and password credential, your name and optional profile details such as a photograph, bio, branch, semester, section, and hostel preference, and the academic and organisational content you create, including tasks, subjects, attendance entries, timetables, polls, forms, board and section records, curriculum selections, reports, and messages or media you upload.
Where you elect to sign in using Google, Google provides us with your name, email address, a profile photograph where available, and a persistent identifier for the Google account used. This information is received under the Google API Services User Data Policy and is used solely to authenticate your identity and to populate your profile. We do not request, receive, or access your Google contacts, calendar, drive files, mail, or any other private Google data.
Where you expressly instruct us to do so, the Student Dashboard feature submits your institutional credentials to the relevant portal and returns the resulting academic records to you, including attendance summaries, fee and examination status, and timetable data. Such data is retrieved on your behalf, is treated as your personal data, and is displayed for your convenience only. We also retrieve publicly available notices and announcements from institutional websites, which contain no personal data about you.
When you use the Service, our infrastructure automatically records technical information such as your requested URL, HTTP status codes, referring page, browser and operating system family, device type, coarse timezone, and the aggregate, non-identifiable analytics and real-user performance measurements described in the section titled "Analytics and Performance Monitoring". We do not collect precise geolocation, government identification numbers, or unique permanent hardware identifiers.
The Service stores preferences and cached content on your device so that pages load quickly and remain available offline. This includes browser local storage entries prefixed "myiter_", which may hold card and layout preferences, onboarding state, guest session markers, notice and menu caches, chat display aliases, and game scores; an offline page cache held in browser storage; and a registered service worker. Device-local data is not transmitted to us unless you submit it or the feature that uses it synchronises it to your account.
We derive limited records about your use of the Service, such as read and unread status for notices and announcements, poll session identifiers, task completion state, attendance percentages calculated from the entries you submit, and moderation flags raised against content. Derived records remain associated with your account for the purpose of operating the relevant feature.
We process personal data only for the purposes set out below, and for any further purpose that is compatible with them and disclosed to you at the time of collection.
To create and administer your account, authenticate your identity, maintain your session, render your personalised dashboard, and deliver the features you request, including attendance tracking, task management, scheduling, and community functions.
To send you service messages, security alerts, academic reminders, notice and menu updates, and push notifications where you have enabled them, and to respond to your support and grievance requests.
To detect, prevent, and investigate unauthorised access, abuse, spam, cheating, harassment, malicious code, and violations of our Terms of Service; to enforce moderation decisions; and to protect the rights, safety, and data of our users and of the public.
To measure aggregate reliability and performance, to diagnose defects, to plan capacity, and to decide which features to develop, retain, or retire.
To comply with applicable law, lawful requests from public or governmental authorities, and to establish, exercise, or defend legal claims.
For users in India, processing of personal data is undertaken on the basis of the consent you provide when you register or continue as a guest, and on the basis of the specific consents recorded for optional functions such as push notifications and the Student Dashboard retrieval of institutional records. You may withdraw a consent at any time; withdrawal does not affect the lawfulness of processing already carried out and may make certain features unavailable to you.
In addition to consent, we process personal data where necessary for the performance of the contract constituted by the Terms of Service, where necessary for purposes that are considered lawful and that are not outweighed by your interests, where you have made the information publicly available, and where necessary for compliance with a legal obligation or for the defence of legal claims.
Where the General Data Protection Regulation or the UK GDPR applies to you, our lawful bases are consent for optional functions, performance of a contract for core account and service delivery, legitimate interests for security, capacity planning, and defect diagnosis, and legal obligation for lawful requests. A consent preference centre is presented to visitors whose device indicates an EEA or UK timezone, and advertising and analytics storage categories are set to denied until you make a choice.
We do not intentionally collect special categories of personal data, such as information concerning health, religion, sexual orientation, biometric identification, financial account numbers, payment credentials, or government identification numbers. We do not process your institutional password for storage, we do not sell personal data, and we do not run advertising networks or cross-site tracking scripts in the application.
Please do not include sensitive personal information about yourself or any other person in content that is visible to other users, including Social Feed posts, chat messages, poll responses, task descriptions, board entries, and report submissions. Where such information is submitted, it is disclosed by you, and you should exercise corresponding caution.
We use strictly necessary cookies and equivalent browser storage to keep you signed in, to protect against cross-site request forgery, to remember your session, and to secure the Service. Authentication sessions are maintained in cookies issued by our backend provider whose names are prefixed "sb-", and a marker cookie is used to identify a Guest Mode session. These technologies cannot be disabled while you use the authenticated parts of the Service.
Layout choices, card order, quick action configuration, greeting state, default section, curriculum selections, game scores, and mute preferences are stored on your device so that the application presents your dashboard consistently and immediately on each visit.
We do not use advertising cookies, advertising identifiers, social media plug-in trackers, or third-party analytics pixels for profiling purposes. Consent categories relating to advertising storage are recorded in the consent preference centre so that they remain denied unless the Service is later changed, in which case this Policy will be updated and your permission sought again where the law requires it.
You may clear local storage and cookies through your browser settings at any time. Doing so will sign you out, reset your preferences, and remove cached offline content, and may cause locally stored Guest Mode data to be lost permanently.
We do not sell, rent, trade, or disclose your personal identification information to third parties in exchange for consideration, and we do not share personal data with advertisers. Generic, aggregated, and de-identified statistics that cannot reasonably be used to identify you may be published for the purpose of describing the usage of the Service.
We disclose personal data to carefully selected processors that perform functions on our behalf, including hosting, database, storage, content delivery, authentication, artificial intelligence inference, browser automation, and messaging. Each provider is engaged under its own terms of service and is permitted to use your data only to deliver the function we require of it. Providers are listed in the section titled "Service Providers and Sub-processors".
Content you publish in community areas is visible to other users of the Service. Posts, comments, chat messages in public channels, poll and form submissions, and section board entries may be read by other students according to the visibility rules of the relevant feature. Anonymous and pseudonymous features conceal your name and email from peers, but they do not conceal your account association from the MyITER Team for moderation purposes.
We may preserve and disclose personal data where we believe in good faith that such action is necessary to comply with a legal obligation, a court order, or a lawful request by a public or governmental authority, to enforce the Terms of Service, to remedy security or technical issues, or to protect the rights, property, safety, or privacy of MyITER, its users, or the public.
If the Service is transferred, discontinued, or reorganised, personal data may be disclosed to the prospective transferee or successor under an obligation of confidentiality substantially consistent with this Policy, and you will be notified where the law requires it.
Supabase provides the PostgreSQL database, authentication, session management, and storage used by the Service. Your profile, content, and attendance records are stored in that database under Row Level Security policies. Data is processed in the region configured for our Supabase project.
Vercel hosts the application, executes server-side functions, and supplies privacy-respecting web analytics and real-user performance measurement as described in the section titled "Analytics and Performance Monitoring".
Uploaded images and archived documents may be stored in object storage compatible with the Amazon S3 or Cloudflare R2 APIs and served through our content delivery domain. Files are addressed by keys that include your user identifier, and public links to those files should be treated as unguessable rather than as access controls.
Where required to reach an institutional portal that employs bot protection, your portal request may be relayed through a third-party browser automation provider located outside India so that the request originates from a compliant browser session. The provider processes the request on our instruction, is not licensed to retain or use the data for its own purposes, and the relay is performed only when you actively use the Student Dashboard feature.
Natural language features, including timetable parsing and conversational assistance, transmit the text you submit to an external large language model provider located outside India for inference. Prompt text is processed to return a result and is not used by us to train models or to build a profile about you.
Notice attachments and curriculum documents may be hosted by your institution on third-party document services such as Box or Google Drive. When you open such a document, your browser communicates directly with that provider, which may record technical request information under its own privacy policy.
Add to calendar and share actions connect to Google Calendar, Apple Calendar, and WhatsApp at your direction. Data included in those requests, such as event titles, times, and shared text, is submitted to the selected provider only because you chose that action.
MyITER is developed and administered in India. Our service providers process data in India and in other jurisdictions, including the United States and member states of the European Union. Where personal data is transferred outside India, we rely on contractual arrangements with our providers, on the safeguards that those providers publish, and, for users in protected regions, on transfer mechanisms required by applicable law.
Where you instruct the Service to communicate with an external system, such as an institutional portal, an external document host, or an integration provider, the related transfer occurs on your instruction and is subject to the terms and privacy practices of that external system.
We use Vercel Web Analytics and Vercel Speed Insights. These tools record aggregate page view counts, referrer information at the domain level, country and device category, and real-user performance measurements such as Core Web Vitals. The measurements are collected without cookies and without fingerprinting, are not associated with an individual, an account, or an IP address, and are not shared with advertising ecosystems.
We do not use Google Analytics, advertising SDKs, session replay tools, heat mapping software, or any service that builds a behavioural profile of individual users. Aggregate records are retained by the analytics provider for the period configured in its platform and are not identifiable to you.
The Service does not display behavioural or targeted advertisements, and we do not permit advertising technology to read data from your browser in order to profile you. Do Not Track and Global Privacy Control signals are therefore not contradicted by any tracking technology of ours.
If advertising, sponsorship, or affiliate placement is introduced in the future, this Policy will be revised before such functionality is enabled, the categories of data shared with advertising partners will be disclosed, and consent will be requested again from users in regions where the law requires prior consent.
Announcements about the Service, academic reminders tied to your configured subjects, and security notices are considered part of the Service and are not marketing communications. Push notifications are optional and can be disabled at any time as described in the section titled "Push Notifications".
When you grant permission in your browser, the browser issues an endpoint URL, cryptographic keys, and an authentication secret for your device. We store that subscription information together with the application server public key and your notification preferences, linked to your account or guest session, so that we can deliver messages to that device.
Messages are delivered through the push service operated by your browser or device vendor, which may process the delivery metadata necessary to route the message. Delivery is not guaranteed, since permission may be revoked by the browser, cleared with site data, or suspended by your operating system. You may stop notifications by revoking permission in your browser settings or by disabling notifications within the application settings.
Personal data and user content are retained for as long as your account remains active or, if shorter, for as long as you retain that content. Deleting an item, such as a task, post, subject, or board entry, removes it from the active database. Content removed by moderation may be retained in redacted or archived form for safety, audit, and legal defence purposes.
A Guest Mode session is valid for thirty (30) days from creation. Expiry data and locally stored preferences are held on your device and are removed when you clear site data, when the guest session lapses and you revisit the application, or when you sign in and merge the session into an account where the feature supports it.
Authentication cookies and tokens persist only for the duration of the session and are rotated on sign-in and sign-out. Expired session state is discarded automatically.
Server logs and aggregate analytics are retained for the periods configured with our hosting providers. Backup copies of the database are retained for a limited disaster recovery window, so a deletion request may not be reflected in backups until those cycles expire, which we expect within ninety (90) days.
All traffic between your device and our servers is encrypted in transit using HTTPS with TLS. Passwords are salted and hashed by our authentication provider and are never held in plain text by MyITER. Database access is governed by Row Level Security policies so that a signed-in user can read and modify only their own records. Administrative access to infrastructure is limited to the maintainers of the Service, and privileged credentials are held in protected environment configuration rather than in the application source.
No method of transmission or storage is completely secure. We cannot guarantee absolute security of your data, and you use the Service at your own risk while we apply reasonable and appropriate safeguards proportionate to the sensitivity of the data processed.
You are responsible for keeping your password confidential, for maintaining the security of the device and browser profile you use to access the Service, and for signing out on shared or public devices. Notify us promptly at [email protected] if you believe your account has been accessed without authority.
We investigate credible reports and indications of a security incident. Where a breach of personal data is confirmed and notification is required by applicable law or is necessary to protect you, we will notify affected users and the competent authority without undue delay.
Subject to the conditions and exemptions of applicable law, you may request access to a copy of your personal data, correction or completion of inaccurate or incomplete data, erasure of personal data that we no longer need to retain, transfer of your data to you or a nominee, withdrawal of consent, and grievance redressal. You may also object to a processing activity and request that we restrict processing while a dispute is resolved.
Most rights can be exercised directly within the application. Profile and account details, settings, card layout, notification preferences, curriculum selections, and EduTrack records can each be reviewed, edited, or cleared from the relevant settings screens. Clearing browser storage removes device-local data.
Requests that require our assistance should be sent from the email address associated with your account to [email protected] and should identify the right you are exercising and the data concerned. We may ask for information necessary to confirm your identity before acting on a request, and we will not require unnecessary personal data to do so.
We act on verified requests within thirty (30) days, and where the law imposes a shorter period we comply with that period. Requests are processed free of charge, unless a request is manifestly excessive or repetitive, in which case we may charge a reasonable fee that reflects the administrative cost or decline the request with written reasons.
Deletion of your account removes your profile, credentials, preferences, and user content from the active systems. Records that we are required or permitted to retain by law, records necessary for the enforcement of the Terms of Service or the defence of legal claims, and aggregated or de-identified statistics that can no longer be attributed to you may be retained.
Where you use the Service as a minor with the consent of a parent or legal guardian, that guardian may exercise these rights on your behalf, and we may require evidence of their authority to act.
You may close your account and request permanent deletion of your personal data by writing to [email protected] from your registered email address, or by using any deletion control made available in the application settings during the period in which such a control is offered. We will confirm the request, and after verification we will delete or de-identify your data within thirty (30) days, subject to the limited retention exceptions described in this Policy.
EduTrack provides a reset function that permanently deletes your subjects, imported timetable, and attendance log without closing your wider MyITER account. That reset cannot be undone and cannot be serviced from our backups.
Content you contributed to public areas may remain visible where it is inseparable from another user contribution, such as a reply within a discussion, or where retention is required for moderation, safety, or legal reasons. Where feasible on request, such content will be anonymised rather than removed.
The Service contains links to, and integrates with, systems that we do not operate, including institutional portals and websites, document hosts, external joke, image, and reference APIs used in experimental features, calendar providers, and messaging applications. This Policy does not apply to those systems. We encourage you to read the privacy notices of every third party with which you interact, as their practices may differ from ours.
The Service is designed for students enrolled in higher education. If you are under eighteen (18) years of age, you may use the Service only with the consent and supervision of a parent or legal guardian, and you should provide us with their contact details if we request them. We do not knowingly collect personal data from a child without the consent of a parent or guardian, and where we become aware that we have done so, we will delete the associated data on request.
Certain experimental sections are marked as suitable only for adults aged eighteen (18) and above. Access to those sections is conditioned on an acknowledgment stored on your device, which is not an age verification mechanism, and the sections remain unavailable to minors.
We may amend this Policy from time to time to reflect changes in the Service, in applicable law, or in our processing activities. The date of the most recent revision is displayed at the top of every policy page. Where an amendment materially reduces your rights or materially expands the categories of data we process, we will provide prominent notice within the application, and where appropriate by email or push notification, before the revised Policy takes effect. Your continued use of the Service after the effective date constitutes acceptance of the revised Policy.
This Policy is governed by and construed in accordance with the laws of India, including the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 to the extent notified and in force, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. Subject to any mandatory consumer protection provisions, the courts at Bhubaneswar, Odisha have exclusive jurisdiction over disputes arising under this Policy.
MyITER maintains a grievance redressal mechanism for privacy complaints, data protection concerns, and complaints regarding content or the conduct of users. Complaints may be filed by writing to [email protected] with the subject line beginning "Grievance". Each complaint is acknowledged within twenty-four (24) hours of receipt and is investigated and disposed of within fifteen (15) days, or within such shorter period as the applicable rules require.
If you are not satisfied with our response, you may approach the adjudicating authority or the grievance officer established under the applicable law, and you retain any remedy available to you under consumer protection law.
Questions about this Policy, requests to exercise your rights, privacy complaints, and reports of mishandled data should be addressed to the MyITER Team at [email protected]. We correspond electronically and will provide you with a reference number for any request that requires further handling.
This notice is a supplement to the MyITER General Privacy Policy, which governs the collection, use, disclosure, retention, and protection of your personal data across the whole of the Service and which applies in full to this feature. Where this notice is silent, the General Privacy Policy applies. Where this notice differs from the General Privacy Policy, this notice prevails for this feature only.
This document took effect on 13 September 2026. Read the General Privacy Policy and the Terms of Service before relying on this document.